Google is working on a new Chrome security feature designed to stop malicious software from hijacking the New Tab page or default search engine through abuse of enterprise policy controls. The protection was spotted by BleepingComputer in a series of work-in-progress Chromium Gerrit changes and has not yet shipped to stable Chrome.
Chrome normally allows organizations to force-install extensions and lock browser settings via enterprise policy, a feature intended for managed devices tied to a domain or mobile device management (MDM) system. According to a Google engineer, Anunoy Ghosh, this mechanism has been abused in “low-trust environments” such as unmanaged consumer devices, where malware writes local Chrome policy keys without user consent.
Once those keys are in place, Chrome can be tricked into believing an extension was installed by an administrator. This can force-install extensions that replace the New Tab page, change the default search engine, or redirect searches to malicious sites, all while blocking the user from removing or disabling the extension. Some victims also see a misleading “Managed by your organization” notice, even though the device has no actual enterprise oversight.
How the fix works
The new feature, tied to a flag called kBlockDseNtpOverrideExtensionsOnUnmanagedDevices, would be enabled by default on unmanaged Windows and macOS devices once approved. Under the change, Chrome would cancel installation attempts for policy-controlled extensions that try to override the New Tab page or search engine, and record the extension ID in a blocked-extension preference to prevent repeated download attempts.
Extensions a user installs manually would no longer be silently converted into locked, policy-managed extensions, preserving the user’s ability to disable or remove them. If a device previously under legitimate management loses its trusted status but retains local policy keys, Chrome would automatically uninstall the affected hijacker extensions.
Google plans to add metrics tracking how often these policy-based hijacking attempts occur and how effectively Chrome blocks them. An escape-hatch policy will remain available for legitimate administrators who need a required enterprise extension to override the New Tab page or search engine.
The Gerrit changes remain under review, so the protection is not yet present in stable Chrome. Security teams managing consumer or BYOD endpoints should watch for this feature’s rollout, as it directly targets a persistent malware technique that has evaded standard extension removal methods.